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Abstract. We present an Authenticated Multiuser Quantum Direct 
Communication(MQDC) protocol using entanglement swapping. Quan- 
tum direct communication is believed to be a safe way to send a secret 
message without quantum key distribution. The authentication process 
in our protocol allows only proper users to participate in communication. 
In this communication stage after the authentication, any two authorized 
users among n users can communicate each other even though there is 
no quantum communication channels between them. In the protocol, we 
need only n quantum communication channels between the authenticator 
and n users. It is similar to the present telephone system in which there 
are n communication channels between telephone company and users and 
any two designated users can communicate each other using telephone 
line through the telephone company. The securities of our protocols are 
analysed to be the same as those of other quantum key distribution pro- 
tocols. 

Introduction-One of the objects of quantum cryptography is to allow two 
distant parties to share a random bit sequence without any reveals to the eaves- 
dropper. The Quantum Key Distribution(QKD) protocols are regarded as un- 
conditionally secure cryptography schemes. The first Quantum key distribution 
was proposed by Bennett and Brassard. It is known as the BB84 protocol]!], and 
it uses four different non-orthogonal states of single photon. QKD establishes a 
common random key between two remote parties of communication. Afterwards 
these two parties can safely exchange a secret message over the public channel by 
encoding and decoding them with the distributed key. If the length of the keys 
is the same as the length of the messages, the communication is unconditional 
secure. It is because that one-time pad scheme with the enough length of secret 
key is proved to be unconditionally secure. QKD has progressed quickly since the 
first QKD protocol was designed |2I3I4I5| . QKD based on quantum mechanics is 
usually non-clcterministic |ll2l3l4l5] . But it is sometimes dcterministic |13ll4H5| . 
in which two remote parties get the same keys determinately. 
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A novel concept of quantum direct communication (QDC) has been proposed 
and pursued recently. Unlike QKD, QDC can directly send secret messages with- 
out creating the key to encrypt them. In 2002, Beige et al. presented the first 
QDC scheme, [H] in which messages can be read after the transmission of classi- 
cal informations. Bostrom and Felbinger put forward a ping-ping scheme using 
entangled pair of qubits in 20020. This protocol can be used for QKD as well 
as QDC. It is secure for key distribution, but is only quasisecure for QDC even 
if perfect quantum channel is used. Cai modified the ping-pong protocol by re- 
placing the entanglement states with single photons in mixed stateJTlij. However 
it is unsafe in a noisy channel and disadvantaged to the opaque attack. 

QDC may have wide application due to its fastness and unconditional secu- 
rity. Our QDC protocol uses entangled states and the entanglement swapping 
effect. It is well known that quantum entanglement swapping 8 can entangle 
two quantum systems which did not interact with each other before. But these 
QDC protocols have a common serious problem. If we don't check whether only 
proper users communicate each other, secret messages can be exposed to the 
eavesdropper. It is, thus, important to certify the identifies of the legitimate 
users in communication line so that no third party monitoring their identifica- 
tion can impersonate either of them. In our protocol, Alice (or Bob) can confirm 
the identification of her (or his) counterpart through the trusted third party, 
Trent, who acts a role of present telephone company. When one of them wants 
to communicate with the other, Trent guarantees the identification of each per- 
son to his (her) counterpart. Afterwards they directly communicate each other 
using quantum communication channels linking them and Trent. 

Our authenticated multiuser QDC scheme using entanglement swapping con- 
sists of two parts; quantum authentication mode and quantum communication 
mode. After finishing authentication mode to identify each other, the messages 
are transmitted secretly and directly in communication mode. 

Entanglement swapping-Let us first describe the quantum entanglement swap- 
ping. Let |0) and |1) be the horizontal and vertical polarization states of a pho- 
ton, respectively. The four Bell states, = ^(|00) ± |11)) and |!f ± ) = 

-^(|0I) ± 1 10} ) are maximally entangled states in two-photon Hilbert space. Let 

the initial state is \4>i 2 ) ® ^34)- We can see that after the Bell measurements on 
the pair of photon 1 and 3 and the pair of photon 2 and 4, there is an explicit 
correspondence between the known initial state of the pair of two qubits and its 
swapped measurement outcomes. The state |^f 2 ) ® I ^34) can be rearranged as 
the linear combinations of the terms, |<£+ 3 ) (g> ® l^ia) ® I ^24) 

and \\Pi 3 ) <8> ^24)- When the outcome of Bell measurement on the pair of photon 
1 and 3 is \&i 3 ), the Bell state of the pair of photon 2 and 4 must be ^24) • The 
outcome of entanglement swapping is summarized in Table ^ 

In our protocol, every user sends Trent the secret identity sequence of Am- 
bits. We call the Alice's(Bob's) secret identity as ID(A)(ID(B)). It must be 
kept safely between the user and Trent. Let us introduce the explicit algorithm 
for the protocol. 

Quantum Authentication 
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Table 1. The outcomes of the swapped Bell measurement on 
the initially different combinations of four Bell states The ab- 
breviation ID++ represents the set of four possible outcomes of Bell 

mfiasurement,C*i>J*M>).(l*r4)J*23)).(l ! ^).l s ^>). and (l*u>> with 
equal probability of 1/4. Similarly, the following cases can be obtained. 

ID + =* {(l^), |H^i»,(l*r 4 >, l*^3»»(l*ii>» I*^»,(l^i4>, l«^»>, Rev + 
+ =► {(|«P+> , |^»,(|^r 4 > ,|^»,(l#£>, l*^3»»(l^ii>, l*23»}> and Rev + - 

I^DMI^), l*2 + 3»>(l*l + 4>> l*J 3 »,(l^ii>, 









l*&> 


1*34 > 




/£ + + 


ID+- 


Rev + + 


Rev + - 


1^2 > 


+ - 


ID + + 


Rev + - 


Rev + + 


l*! + 2 > 


i?et> + + 


Rev + - 


ID + + 


ID + - 


l*T 2 > 


i?eu + - 


Rev + + 


ID + - 


ID + + 



(A.O) Authentication process begins when Alice asks Trent that she wants to com- 
municate with Bob. 

(A.l) Trent prepares an ordered set of 27V pairs of Bell state of \<P+) = ^(|00) + 
1 1 } ) . We denote the 2N ordered EPR pairs as[(P 1 (T),P 1 (A)),(P 2 (T),P 2 (A)), 
....,(P N (T),P N (A))]and [(P N+ i(T),P N+ i(B)),(P N+2 (T),P N+2 (B)),....,(P 2N (T),P 2N (B))]. 
Here the subscript indicates the ordering number of pairs, and T, A, and B 
represent the qubits of Trent, Alice and Bob, respectively. 

(A.2) Trent takes one qubit from each EPR pair, say, [Pi (T), P 2 (T), P N (T)] 
([P N+ i(T),P N+2 (T), P 2N (T)]) which is called the A(P)-checking sequence, 
and keep it safely. The remaining sequence of qubits [Pi (A) , P 2 (A) , . . . , Pjv (A)] 
([Pn+i(B), Pn+ 2 {B), P 2 n{B)}) is called the A(P)-authentication sequence. 

(A. 3) Trent encodes A(P)-authentication sequence with Alice's(Bpb's) identifica- 
tion numbers ID {A) (ID(B)). If the i-th value of ID (A) is 1, Trent makes 
an Hadamard operation H to i-th qubit of A(P)-authentication sequence. If 
it is 0, identity operation I is applied. The results of the operation on Pi(A) 
is {(1 - IDi(A))I + IDi(A)H}Pi(A). 

(A. 4) Trent sends the A(P)-authentication sequences [Pi (A), P 2 (A), P N (A)], 
{[P N+ i(B),P N+2 (B),...,P 2N (B)]) to Alice(Bob). 

(A. 5) The legitimate user, Alice(Bob) knows hcr(his) ID sequence. She(he) de- 
codes the yl(P)-authentication sequence with hcr(his) ID sequence. The 
decoding method is the same as the Trent's encoding method. According 
to the ID sequence, Alice(Bob) makes an Hadamard operation H or does 
nothing to the qubits of A(P)-authentication sequence. By this decoding op- 
eration, the qubits are restored to their original state. Then she(he) measures 
her(his) sequence in the o z basis, and announces the outcomes. 

(A. 6) Trent measures the ordered yl(P)-checking sequence and compare the results 
with the Alice's(Bob's) results. If Alice's(Bob's) result is the same as Trent's, 
then authentication succeeded. Otherwise, authentication failed and abort 
communication. 
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Quantum Direct Communication 

(C.l) Alice prepares a random sequence of M + n + q Bell states from two states, 
\$ + )t a a = ^(100) + |11)) and \* + )t a a = ^ (|01) + |10)).. This random 
choice is Alice's secret information. Bob prepares M + n + q Bell states of 
|^ + )t b b = "^(lOO) + 1 1 1 ) ) - - The subscripts of the states represents who is 
going to keep them after the process of (C.2). 

(C.2) Alice(Bob) takes one qubit from each pair and sends Trent the ordered string 
of M+n+q qubits which is named as the j4-sequence(_B-sequence) hereafter. 
Alice(Bob) stores the remaining ordered sequence of qubits in a safe place, 
which is named as the encoding sequence (the decoding sequence) hereafter. 

(C.3) Alice randomly chooses n checking positions of the ordered encoding se- 
quence and publicly announces it. Trent measures the n checking qubits of 
the ordered ^-sequence by using a z basis and tells the outcomes to Alice. 
Alice measures the corresponding qubits of the encoding sequence by using 
a z basis and compares it with Trent's outcomes. She estimates error rate and 
can detect a eavesdropper. Bob's checking method is the same as that of Al- 
ice and Trent. They can detect eavesdropper on the channel of Alice- Trent 
or Bob- Trent. 

(C.4) Trent performs Bell measurements on the qubits of the ordered A and B 
sequences. In this Bell measurement, Trent does not have to distinguish all 
of four different Bell states, but only needs to distinguish and |tf' ± ) 

states. After the Trent's measurement, the encoding sequence possessed by 
Alice and the decoding sequence possessed by Bob became to be entan- 
gled(Entanglement Swapping). Trent sends his measurement outcomes to 
Alice. 

(C.5) Alice receives the Trent's outcome and measures the encoding sequence with 
o~ z basis. She randomly chooses q checking positions of the ordered encoding 
sequence and publicly announces the positions. Bob performs measurement 
on the corresponding q checking positions of the decoding sequence with 
o~ z basis and tells the outcome to Alice. Alice can infer Bob's measurement 
outcome from the effect of entanglement swapping, the information of Trent's 
measurement outcome, her initial Bell state and her measurement outcome. 
Alice compares her inference with Bob's corresponding announcements. If 
there is no eavesdropper on the line, their corresponding results should be 
correlated. If there is no correlation, the communication is aborted. Tabled 
shows the correlations. 

(C.6) According to Alice's bit strings, she publicly announces the positions that 
Bob needs to flip his measurement outcome on his decoding sequence. As 
she knows Bob's measurement outcome by using entanglement swapping 
effect, she can send decoding information to Bob. Bob flips the value of 
his measurement outcome of the position that Alice informed. Then he can 
decode the her secret message. 

For example, let's suppose that Alice prepares the ordered set of Bell states 
{|$ + ), |^ + ), I & + )}, and Trent's Bell measurement outcomes are {|<£ + ), \& + ), \& + )}- 
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Table 2. The correlation of entanglement swapping 
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When Alice's measurement outcomes of the encoding sequence are {0, 0, 1}, Al- 
ice knows that Bob's outcomes must be {0, 1, 1}. Suppose that Alice's secret 
message bit is 101. According to the message, Alice publicly announces 110 which 
designates the positions Bob needs to flip his measurement outcome. After the 
flipping, Alice's message is transferred to Bob. 

Security analysis - The proof of the security of our QDC protocol is based 
on the security of the transmission of the A- and B-sequence. The state of 
the transmitted qubits does not contain any information of the secret message 
because they are completely random and mixed. The exposed information is 
just random like that of coin flipping. In our protocol, even Trent can not know 
Alice's secret message since he doesn't know Alice's initial state. 

The qubit transmission and the checking method in our protocol is similar to 
the procedure in BBM92 QKD protocol[I0|. Alice stores the encoding-sequence 
in her safe place, and Eve cannot access it at all. Therefore, the security of our 
protocol is the same as that of the BBM92 QKD protocol. The proof of security 
for BBM92 protocol in ideal and practical conditions has been given |11I12| . So 
our protocol is also unconditionally secure. 

Conclusion - We have established the authenticated quantum multiuser direct 
communication using entanglement swapping. Its security is the same as that of 
BBM92 protocol, which is unconditionally secure. The encoding of the message 
is processed only after the authentication of the users and the confirmation of 
the security of the quantum channel. Our protocol, therefore, is not in danger 
of exposure of information to Eve. Furthermore the leaked information to Eve 
is totally random, and does not contain any information. 

In this protocol we need only EPR paris. It can be advantage in an experi- 
ment. The great feature of our protocol is that any two users among n subscribers 
can communicate each other. We don't need any quantum channel linking two 
users, because the center, Trent, connects two users Alice and Bob, and authen- 
ticates them. This structure is the same as that of nowadays telephone system, 
but its security is much better than present technology. It is unconditionally 
secure. Our scheme may be used for the safe communication system. 
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